Sep 15, 20261 ruleDetecting Kerberoasting with WazuhThe rule is six lines of XML. The part that actually mattered was a query I ran before writing any of it.T1558.003wazuhdetection-engineeringactive-directory+3